In an industrial facility, what is the MOST critical risk when ICS devices are not segmented from the main network?

• A. The ICS devices are using outdated protocols
• B. Lack of encryption on internal ICS communications
• C. The ICS devices are not segmented from the rest of the network and are vulnerable to attack
• D. Excessive access control

Answer: (C)

Keeping ICS devices separate from the main IT network creates a boundary that limits how far an attacker can move if the IT network is breached. When those systems are not segmented, a compromise on the corporate network can quickly spread into the OT/ICS environment, giving an attacker access to PLCs, HMIs, SCADA servers, and other control equipment. That direct path can lead to taking control of processes, causing production outages, equipment damage, or unsafe conditions—effects that are far more dangerous in an industrial setting than typical IT breaches.

Segmentation enables applying strict controls, monitoring, and separate security policies for the ICS environment, so even if IT systems are compromised, the blast radius within operational technology stays limited. This containment is why lack of segmentation is considered the most critical risk.

While issues like using outdated protocols or lack of encryption on ICS communications are important security concerns, they do not by themselves address the fundamental risk of cross-network access. Excessive access control would generally reduce risk, not create it.